MoonSharp has two extra load functions (loadsafe and loadfilesafe) which loads code and puts it in a different top-of-the-stack index (which in Lua 5.1 would be the Lua globals index), this means you can make the code not being able to access other function environments. This can't be done on Lua 5.1 and leaves it very unprotected to the setfenv and getfenv functions, but since MoonSharp supports this, have you planned to make the client-side receive scripts from the server? loadsafe and loadfilesafe seem to be a reliable way to not let servers use Lua scripts on bad purposes against the players that join them.
Edit: I forgot that this is Lua 5.2, but loadsafe should still be able to work like load does.
edited 1×, last 12.09.15 06:43:35 am